Data processing
Four of our five products are ours to answer for. One is not. This page explains which, why it matters to you, and what we sign.
MS-LEG-003 · First Edition · 14 September 2026 · Download the signed form (PDF)
This Data Processing Agreement is made between Module Six Ltd, registered in England and Wales under company number 17311940, whose registered office is c/o KRW Accountants Ltd, Henge Barn, Pury Hill Business Park, Alderton Road, Towcester, Northamptonshire, NN12 7LS (Module Six, we, us), and the customer named in the Order (the Customer, you).
It is the agreement required by Article 28(3) of the UK GDPR. It forms part of, and is subject to, the Terms of Service for Organisations (MS-LEG-002), and it applies automatically and only where section 11 of that agreement applies, being the supply of Validate. It cannot be opted out of.
It governs personal data that Module Six processes on the Customer's behalf in an Authority to Work register, and nothing else.
UK GDPR means Regulation (EU) 2016/679 as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018, together with the Data Protection Act 2018.
Controller, processor, data subject, personal data, processing, personal data breach and supervisory authority have the meanings given in the UK GDPR.
Customer Personal Data means the personal data described in clause 3, which Module Six processes on the Customer's instructions under this Agreement.
Sub-processor means any processor engaged by Module Six to process Customer Personal Data.
Register means the Customer's Authority to Work records held in Validate.
Principal Agreement means MS-LEG-002 together with the Order.
For Customer Personal Data, the Customer is the controller and Module Six is the processor. The Customer determines the purposes and means of the processing; Module Six processes only on the Customer's documented instructions.
The Customer warrants that it has a lawful basis for the processing it instructs, that it has provided the privacy information required by Articles 13 and 14 to the individuals in its Register, and that its instructions will not put Module Six in breach of the UK GDPR.
2.1 Individuals with no relationship with Module Six. Many of the individuals in a Register are workers who hold no Module Six account and have never had a direct relationship with Module Six. Informing them is the Customer's responsibility as controller. Module Six has no route to do it and does not undertake to.
2.2 Where Module Six is controller. Module Six processes personal data as controller in its own right for the Customer's administrator accounts, for billing records, and for every service other than Validate, including but not limited to Calibrate, Educate, Activate, Candidate and Institute membership. That processing is outside this Agreement and is governed by MS-LEG-004.
The subject matter is the operation of the Validate Authority to Work register for the Customer. Processing continues for the term of the Principal Agreement and for the period after termination described in clause 9.
Recording which workers hold which competencies, when those competencies were issued and when they expire; recording what each worker is authorised to do; storing evidence supplied in support; issuing expiry reminders; and producing reports that let the Customer demonstrate who is cleared to do what.
Categories of data subject: the Customer's workers, contractors and agency staff recorded on the Register, and the Customer's administrators and managers who operate it.
Types of personal data. Validate is designed to hold: name; employee reference; work email address; job title and post; manager's name and work email address; cost centre, department and team; competencies held, with issue and expiry dates; authorisations held, with references and expiry; evidence documents supplied by or about the worker, which may include certificates and training records; submission and approval history; and a record of changes made to the Register.
That description is not a limit and not an instruction. What is actually uploaded to a Register is the Customer's decision as controller and the Customer remains accountable for it. This clause exists because Article 28(3) requires the agreement to specify the types of personal data and the categories of data subject.
The Customer must not upload special category data as defined in Article 9, or criminal offence data as defined in Article 10, unless the parties have first agreed in writing the additional measures required. Validate is not designed to hold it, and its evidence store applies no additional controls for it.
This Agreement covers the sixteen data stores that make up the Register and nothing else.
It does not cover any record for which Module Six is the controller. That includes, without limiting the generality of that statement: user accounts and identity; competency self-assessments and validation history; continuing professional development records; portfolio evidence held outside a Register; published records, Passports and talent window profiles; quotations, orders and billing; and Institute membership, assessment and conduct records. Those are held under MS-LEG-004, on their own lawful bases and their own retention periods, and the Customer cannot instruct their deletion under clause 9.
The boundary is enforced in the platform. The deletion in clause 9 acts on the Register and is prevented by automated test from acting on anything else.
Module Six shall process Customer Personal Data only on the Customer's documented instructions, including as to transfers to a third country, unless required to do otherwise by law; in which case Module Six shall inform the Customer of that requirement before processing, unless the law prohibits it.
This Agreement, together with the Principal Agreement and the Customer's use of the platform's features, constitutes the Customer's documented instructions. Any further instruction shall be given in writing to the address in clause 13.
Module Six shall ensure that persons authorised to process Customer Personal Data are subject to an appropriate duty of confidence.
Module Six shall promptly inform the Customer if, in its opinion, an instruction infringes the UK GDPR or other data protection law.
Module Six shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking account of the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as required by Article 32. Those measures include:
The measures in force are recorded in full in MS-LEG-006, which Module Six shall make available to the Customer on request. Module Six reviews them periodically and may change them, provided the level of security is not reduced.
The Customer gives Module Six general written authorisation to engage sub-processors, subject to this clause.
Module Six has entered into, and shall maintain, a written agreement with each sub-processor containing data protection obligations no less protective than those in this Agreement, and remains fully liable to the Customer for the performance of each sub-processor's obligations. Where a sub-processor's standard data processing terms are the means by which those obligations are imposed, Module Six shall keep a copy of the version in force and provide it on request.
The sub-processors engaged at the date of this Agreement are:
6.1 Adding or replacing a sub-processor. Module Six shall give the Customer at least fourteen days' written notice before adding or replacing a sub-processor. The Customer may object on reasonable data protection grounds within that period, in which case the parties shall discuss the objection in good faith; if it cannot be resolved, the Customer may terminate section 11 of the Principal Agreement without penalty and with a pro rata refund of Fees paid for the unexpired term.
6.2 Urgent replacement. Where a sub-processor fails, is withdrawn, or presents a security or continuity risk requiring immediate action, Module Six may replace it without prior notice, provided the replacement is bound by this clause, that Module Six notifies the Customer as soon as reasonably practicable, and that the Customer's rights under clause 6.1 then apply from the date of that notice.
6.3 Artificial intelligence. No sub-processor engaged at the date of this Agreement applies automated or artificial intelligence analysis to Customer Personal Data, and Module Six does not do so. If Module Six introduces it, the provider becomes a sub-processor and clause 6.1 applies before any Customer Personal Data reaches it. Customer Personal Data is not, and will not be, used to train any model.
7.1 Where the Register is held. The Register itself is stored in Cloudflare infrastructure within the United Kingdom and the European Economic Area.
7.2 Transfers that do occur. Two sub-processors are established in the United States and personal data reaches them there. Clerk receives the email addresses of administrators, and of workers where an account or sign-in link is issued. Resend receives the name, email address and message content of any reminder or notification sent.
7.3 The safeguard. Each of those transfers is made under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or another transfer mechanism recognised under Article 46. Module Six does not rely on the EU-US Data Privacy Framework for any transfer under this Agreement, so that the safeguard survives a certification lapsing. The mechanism relied on for each supplier is recorded in MS-LEG-005 and provided on request.
Taking into account the nature of the processing, Module Six shall assist the Customer by appropriate technical and organisational measures, insofar as possible, in fulfilling its obligation to respond to requests to exercise data subject rights.
Where a data subject contacts Module Six directly about their Register record, Module Six shall not respond substantively, and shall direct them to the Customer and inform the Customer without undue delay. The controller answers, and the controller is the Customer.
Module Six shall assist the Customer in complying with Articles 32 to 36, taking into account the nature of processing and the information available to it. Module Six's own assessment of the Validate processing is an annex to MS-LEG-006 and is available on request.
At the Customer's choice, on termination or expiry of section 11 of the Principal Agreement, Module Six shall return the Register to the Customer, delete it, or return it and then delete it.
Return is provided as a complete export of the Register in a structured, machine-readable format, comprising every record in every one of the sixteen data stores described in clause 3. Evidence documents are supplied alongside it.
Deletion removes every record of the Register, and every evidence document, from Module Six's systems. It is not reversible.
Unless the Customer instructs otherwise in writing, Module Six shall retain the Register for ninety days after termination or expiry, so that the Customer may request its return, and shall delete it at the end of that period. During that period the Register is not available for operational use. The Customer may instruct deletion sooner, or a longer period, in writing.
The deletion in this clause acts on Module Six's own systems, which is where the Register resides. Two sub-processors may separately hold limited personal data derived from it, and Module Six does not have a deletion interface to either:
Module Six shall certify the deletion in writing on request, stating what was deleted, when, and what remained under this clause.
Module Six may retain Customer Personal Data to the extent required by law, and shall in that case retain only what the law requires, for only as long as it requires, and shall continue to protect it under this Agreement.
Module Six applies no retention period of its own to the Register. Records are retained until the Customer deletes them or this Agreement ends, because how long a competence record should be kept is a decision for the Customer as controller and depends on its own regulatory obligations.
The Customer may specify a retention period in the Order, in which case Module Six shall apply it.
Module Six shall make available to the Customer all information necessary to demonstrate compliance with Article 28, and shall allow for and contribute to audits, including inspections, conducted by the Customer or an auditor it mandates.
The Customer shall give at least thirty days' notice of an audit, conduct it during business hours, take reasonable steps to avoid disrupting Module Six's operations, and not conduct more than one audit in any twelve-month period unless required by a supervisory authority or following a personal data breach affecting Customer Personal Data.
Module Six maintains a record of every deletion carried out under clause 9, stating who authorised it, what was removed and when, and shall make that record available on request.
Module Six shall notify the Customer without undue delay, and in any event within seventy-two hours, after becoming aware of a personal data breach affecting Customer Personal Data.
The notification shall describe, so far as known: the nature of the breach, including the categories and approximate number of data subjects and records concerned; the likely consequences; the measures taken or proposed to address it; and a contact point for further information. Where the information is not all available at once, Module Six shall provide it in phases without undue further delay.
Module Six shall not notify a supervisory authority or any data subject on the Customer's behalf unless the Customer instructs it to, or Module Six is required to by law. Notification under Articles 33 and 34 is the controller's duty. The procedure Module Six follows is recorded in MS-LEG-006.
In the event of conflict between this Agreement and the Principal Agreement in respect of the processing of Customer Personal Data, this Agreement prevails.
This Agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
Notices shall be given in writing to data@modulesix.co.uk for Module Six, and to the contact named in the Order for the Customer.
Nothing in this Agreement limits either party's obligations under the UK GDPR, or excludes liability that cannot lawfully be excluded.
Former references. These terms were issued on 16 August 2026 as MS-DPA-001 and renumbered on 25 August 2026 to MS-DAT-002. Neither renumbering changed any obligation. Where any agreement, consent record, web page or other document refers to MS-DPA-001 or MS-DAT-002, that reference is to this Agreement.
Where the Order is placed online, acceptance of MS-LEG-002 at checkout by a person authorised to bind the Customer constitutes execution of this Agreement. Where Module Six loads a workforce onto a Register on the Customer's behalf, a signed copy is required in addition and the import is refused until that signature is recorded.
Signed for and on behalf of Module Six Ltd:
Name ________________________ Position ________________________
Signature ________________________ Date ________________________
Signed for and on behalf of the Customer:
Name ________________________ Position ________________________
Signature ________________________ Date ________________________
